Shadow AI \u2013 the unsanctioned use of artificial intelligence tools by employees without organisational policy, oversight, or formal approval \u2013 has become one of the defining governance failures in enterprise technology today.<\/p>\n
As Vercel\u2019s recent breach<\/a> makes clear, the consequences reach well beyond an IT department\u2019s inbox. Customer data, intellectual property, and hard-won regulatory standing are all in play. And with EU AI Act<\/a> enforcement arriving in August 2026, the window to get ahead of this risk is closing faster than most boards realise.<\/p>\n What Is Shadow AI, and How Did It Become an Enterprise Problem?<\/p>\n The term will be familiar to anyone who spent the 2010s arguing with employees about personal Dropbox accounts and WhatsApp groups. Shadow IT \u2013 the use of unsanctioned software to fill gaps left by corporate tooling \u2013 costs organisations millions in data exposure and regulatory fines before boards eventually catch up. The pattern is repeating. The difference this time is scale, speed, and sensitivity.<\/p>\n AI tools are more capable, more personally compelling, and more deeply embedded in daily workflows than a shared spreadsheet ever was. The data employees feed into them \u2013 customer transcripts, product roadmaps, deal intelligence, HR records \u2013 is often far more valuable and legally protected than anything that passed through a rogue Dropbox folder.<\/p>\n We sat down with Gary Hibberd, Head of Consultants Like Us<\/a>, to get his perspective:<\/p>\n \u00a0\u201cWe are trying to implement AI on top of data chaos. A lot of organisations don\u2019t really understand their current platforms.\u201d<\/p>\n Before shadow AI can be governed, many organisations first need a clearer picture of what data they hold \u2013 and where it already lives.<\/p>\n Does the Board Understand the Risk Shadow AI Poses?<\/p>\n In a word: no. And Hibberd does not soften the assessment.<\/p>\n \u201cFor most people, AI has only been around since 2022,\u201d he says. The mental model most boards are working from is that of a conversational search tool. The reality \u2013 AI embedded in CRM platforms, customer service workflows, contact center infrastructure, and employee productivity suites \u2013 is categorically different, and the risk exposure that comes with it is orders of magnitude larger.<\/p>\n \u201cOne of the biggest risks the board is facing is shadow AI,\u201d Hibberd says. \u201cPeople are using it in the workspace without any real guardrails \u2013 policies, procedures, training, explaining to people about not putting confidential data into AI. That could be personal data, but it could also be the intellectual property of the company.\u201d<\/p>\n A recent EY survey<\/a> found that 99% of organisations surveyed had experienced financial losses from AI-related risks, with compliance failures, flawed outputs, and data exposure among the most common causes. Estimated combined losses across surveyed firms reached $4.4 billion.<\/p>\n Is Shadow AI a Security Failure \u2013 or a Leadership One?<\/p>\n This is the reframe most organisations are still missing. Shadow AI is not, at its root, a discipline problem. It is a clarity problem \u2013 and that makes it a leadership responsibility.<\/p>\n \u201cAI offers lots of opportunities to get quicker and better at what we do,\u201d Hibberd says. \u201cSo people are using it indiscriminately in their organisations without any real forethought about what they\u2019re using it for.\u201d Employees are not acting recklessly; they are responding rationally to capable tools, competitive pressure, and an organisational vacuum where policy should be.<\/p>\n Hibberd describes this as \u201cadoption without clarity.\u201d Organisations have not defined what AI is actually for \u2013 so individuals do it themselves. Without those answers at the leadership level, individuals fill the vacuum themselves \u2013 and the results increasingly land in boardroom risk registers and regulatory investigations.<\/p>\n \u201cNone of it\u2019s technical,\u201d Hibberd says of the governance conversation. \u201cIt\u2019s business. Security is not an IT risk; it\u2019s a business risk.\u201d<\/p>\n How Should Organisations Respond to Shadow AI?<\/p>\n The instinct is to reach for tools \u2013 an AI governance platform, a usage monitoring solution, a vendor agreement. Hibberd\u2019s prescription is to start with the fundamentals:<\/p>\n \u201cMy first suggestion would be to look at the EU AI Act<\/a>,\u201d he says. \u201cWe need to think about being fair, transparent, and effective, which are the act\u2019s core principles.\u201d Rather than framing compliance as a legal department exercise, he argues that those three principles offer a practical governance lens that any business leader can engage with, regardless of technical fluency.<\/p>\n The next step is accountability of ownership:<\/p>\n \u201cYou need someone in your organisation who is looking at the broader context of AI \u2013 looking at the effectiveness, the fairness, and the transparency of the tools, and then looking at simple security principles: governance, risk, and compliance.\u201d<\/p>\n